What did Ledger breach expose?

TLDR

Ledgers latest breach exposed customer names, emails, phone numbers, postal addresses, and some order details via payment partner Global?e; private keys and funds were not affected.

1. Exposed fields include names, contact info, and order details per a third?party incident linked to Global?e (CryptoSlate).
2. Private keys, recovery phrases, wallet funds, and payment data remained secure (CoinDesk).
3. Only customers who purchased via Global?e were impacted, and phishing attempts have already ramped up (CryptoPotato).

Deep Dive

1. What Was Exposed

Customer personal data stored by Global?e was accessed, including names, emails, phone numbers, postal addresses, and order details such as order number and product purchased (CryptoSlate). A separate report adds price paid in the order details and reiterates that payment credentials were not affected (Yahoo Finance).

2. What Was Not Exposed

Ledgers core self?custody model remained intact. Private keys, recovery phrases (24 words), wallet balances, and payment card or bank information were not accessed (CoinDesk). Ledger emphasized the incident was confined to a third?party commerce stack and did not touch hardware, firmware, or wallet software (Coinspeaker).

3. Who Was Affected and Near?Term Risks

Impact is scoped to customers who purchased via Global?e as Merchant of Record, not all Ledger users (The Block via TradingView). Within hours, phishing campaigns appeared, including fake LedgerTrezor merger emails urging users to migrate by entering recovery phrases on a spoofed site (CryptoPotato).

Conclusion

The breach exposed personal and order data held by Global?e, not Ledgers wallet secrets. Keys and funds remain secure, but phishing risk is elevated. The immediate priority is vigilance: verify communications, use clear?signing, and never share recovery phrases.